CIRCL/vulnerability-attack-techniques huggingface dataset:
CVE-2013-1289: 
Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1, Groove Server 2010 SP1, SharePoint Foundation 2010 SP1, and Office Web Apps 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted string, aka "HTML Sanitization Vulnerability."

ATT&CK techniques (all): T1190
CVE-2025-24016: Remote code execution in Wazuh server
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.

Affected products: wazuh wazuh
CWE: CWE-502: Deserialization of Untrusted Data
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
ATT&CK exploitation technique(s): T1078
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1203
ATT&CK techniques (all): T1059, T1078, T1203
CVE-2020-8193: 
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.

Affected products: Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
CWE: CWE-284 Improper Access Control - Generic (CWE-284)
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
ATT&CK exploitation technique(s): T1556
ATT&CK primary impact: T1005
ATT&CK techniques (all): T1005, T1556
CVE-2018-2894: 
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected products: Oracle Corporation WebLogic Server
CWE: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
ATT&CK techniques (all): T1190, T1505.003
CVE-2017-14487: 
The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API server and then editing the username, user_id, and token fields in data/data/com.ohmibod.remote2/shared_prefs/OMB.xml.

ATT&CK techniques (all): T1204, T1552, T1566
CVE-2014-8551: 
The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to execute arbitrary code via crafted packets.

ATT&CK techniques (all): T1190
CVE-2024-50603: 
An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.

Affected products: Aviatrix Controller
CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1055
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1055, T1059
CVE-2020-8515: 
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.

CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1133
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1496
ATT&CK techniques (all): T1059, T1133, T1496
CVE-2019-1915: Multiple Cisco Unified Communications Products Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition (SME), Cisco Unified Communications Manager IM and Presence (Unified CM IM&amp;P) Service, and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections by the affected software. An attacker could exploit this vulnerability by persuading a targeted user to click a malicious link. A successful exploit could allow the attacker to send arbitrary requests that could change the password of a targeted user. An attacker could then take unauthorized actions on behalf of the targeted user.

Affected products: Cisco Cisco Unified Communications Manager
CWE: CWE-352
CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
ATT&CK exploitation technique(s): T1189, T1190, T1204.002, T1566
ATT&CK primary impact: T1068
ATT&CK secondary impact: T1098
ATT&CK techniques (all): T1068, T1098, T1189, T1190, T1204.002, T1566
CVE-2020-25506: 
D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.

CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1133
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1584.005
ATT&CK techniques (all): T1059, T1133, T1584.005
CVE-2013-3897: 
Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code that uses the onpropertychange event handler, as exploited in the wild in September and October 2013, aka "Internet Explorer Memory Corruption Vulnerability."

CWE: CWE-416 Use After Free
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1203
CVE-2022-0028: PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering
A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (virtual) and CN-Series (container) firewall against an attacker-specified target. To be misused by an external attacker, the firewall configuration must have a URL filtering profile with one or more blocked categories assigned to a source zone that has an external facing interface. This configuration is not typical for URL filtering and, if set, is likely unintended by the administrator. If exploited, this issue would not impact the confidentiality, integrity, or availability of our products. However, the resulting denial-of-service (DoS) attack may help obfuscate the identity of the attacker and implicate the firewall as the source of the attack. We have taken prompt action to address this issue in our PAN-OS software. All software updates for this issue are expected to be released no later than the week of August 15, 2022. This issue does not impact Panorama M-Series or Panorama virtual appliances. This issue has been resolved for all Cloud NGFW and Prisma Access customers and no additional action is required from them.

Affected products: Palo Alto Networks Cloud NGFW, Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access, paloaltonetworks pan-os
CWE: CWE-406 Insufficient Control of Network Message Volume (Network Amplification)
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1498
ATT&CK techniques (all): T1190, T1498
CVE-2018-18641: 
An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Cleartext Storage of Sensitive Information.

ATT&CK techniques (all): T1528, T1552
CVE-2014-5334: 
FreeNAS before 9.3-M3 has a blank admin password, which allows remote attackers to gain root privileges by leveraging a WebGui login.

ATT&CK techniques (all): T1203
CVE-2018-8589: 
An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2.

Affected products: Microsoft Windows Server 2008, Microsoft Windows 7, Microsoft Windows Server 2008 R2
CWE: Elevation of Privilege, CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1203
CVE-2020-5345: 
Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions prior to 9.1.0.17, and PowerMax OS Release 5978 contain an authorization bypass vulnerability. An authenticated malicious user may potentially execute commands to alter or stop database statistics.

Affected products: Dell Unisphere for PowerMax
CWE: CWE-602: Client-Side Enforcement of Server-Side Security
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
ATT&CK exploitation technique(s): T1565.001
ATT&CK primary impact: T1190
ATT&CK techniques (all): T1190, T1565.001
CVE-2018-1956: 
IBM Security Identity Manager 6.0.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 153628.

Affected products: IBM Security Identity Manager
CWE: Obtain Information
CVSS: CVSS:3.0/A:N/AC:H/AV:N/C:H/I:N/PR:N/S:U/UI:N/E:U/RC:C/RL:O
ATT&CK techniques (all): T1110
CVE-2014-1761: 
Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, as exploited in the wild in March 2014.

CWE: CWE-787 Out-of-bounds Write
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1190, T1569
CVE-2021-22204: 
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

Affected products: ExifTool ExifTool
CWE: Improper neutralization of directives in dynamically evaluated code ('eval injection') in ExifTool, CWE-94 Improper Control of Generation of Code ('Code Injection')
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1059, T1190
CVE-2025-32701: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

Affected products: Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation)
CWE: CWE-416: Use After Free
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
ATT&CK exploitation technique(s): T1059, T1068
ATT&CK primary impact: T1003.001, T1543, T1608.001
ATT&CK techniques (all): T1003.001, T1059, T1068, T1543, T1608.001
CVE-2010-1592: 
sandra.sys 15.18.1.1 and earlier in the Sandra Device Driver in SiSoftware Sandra 16.10.2010.1 and earlier allows local users to gain privileges or cause a denial of service (system crash) via unspecified vectors involving "Model-Specific Registers."

ATT&CK techniques (all): T1068, T1574.001
CVE-2018-7506: 
The private key of the web server in Moxa MXview versions 2.8 and prior is able to be read and accessed via an HTTP GET request, which may allow a remote attacker to decrypt encrypted information.

Affected products: ICS-CERT Moxa MXview
CWE: Information Exposure
ATT&CK techniques (all): T1133, T1552.004
CVE-2023-22518: 
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. 

Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Affected products: Atlassian Confluence Data Center, Atlassian Confluence Server
CWE: Improper Authorization, CWE-863 Incorrect Authorization
CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1033
ATT&CK secondary impact: T1105
ATT&CK techniques (all): T1033, T1105, T1190
CVE-2019-1812: Cisco NX-OS CLI Command Software Image Signature Verification Vulnerabilities
A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device.

Affected products: Cisco Cisco NX-OS Software
CWE: CWE-347
CVSS: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1078
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1548
ATT&CK techniques (all): T1059, T1078, T1548
CVE-2020-3133: Cisco Email Security Appliance Content Filter Bypass Vulnerability
A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured filters on the device. The vulnerability is due to improper validation of incoming emails. An attacker could exploit this vulnerability by sending a crafted email message to a recipient protected by the ESA. A successful exploit could allow the attacker to bypass the configured content filters, which could allow malicious content to pass through the device.

Affected products: Cisco Cisco Email Security Appliance (ESA)
CWE: CWE-20
CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
ATT&CK exploitation technique(s): T1566.001
ATT&CK primary impact: T1190
ATT&CK techniques (all): T1190, T1566.001
CVE-2022-1040: 
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.

Affected products: Sophos Sophos Firewall
CWE: CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1040, T1078, T1557, T1574
ATT&CK techniques (all): T1040, T1059, T1078, T1190, T1557, T1574
CVE-2009-1612: 
Stack-based buffer overflow in the MPS.StormPlayer.1 ActiveX control in mps.dll 3.9.4.27 in Baofeng Storm allows remote attackers to execute arbitrary code via a long argument to the OnBeforeVideoDownload method, as exploited in the wild in April and May 2009. NOTE: some of these details are obtained from third party information. NOTE: it was later reported that 3.09.04.17 and earlier are also affected.

ATT&CK techniques (all): T1068
CVE-2020-1472: Netlogon Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network.
To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.
Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels.
For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see  How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020).
When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

Affected products: Microsoft Windows Server version 2004, Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server, version 1909 (Server Core installation), Microsoft Windows Server, version 1903 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server version 20H2
CWE: Elevation of Privilege, CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
ATT&CK exploitation technique(s): T1110, T1133
ATT&CK primary impact: T1021, T1068, T1087.002
ATT&CK secondary impact: T1087.002, T1133, T1486
ATT&CK techniques (all): T1021, T1068, T1087.002, T1110, T1133, T1486
CVE-2020-3477: Cisco IOS and IOS XE Software Information Disclosure Vulnerability
A vulnerability in the CLI parser of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to access files from the flash: filesystem. The vulnerability is due to insufficient application of restrictions during the execution of a specific command. An attacker could exploit this vulnerability by using a specific command at the command line. A successful exploit could allow the attacker to obtain read-only access to files that are located on the flash: filesystem that otherwise might not have been accessible.

Affected products: Cisco Cisco IOS
CWE: CWE-20
CVSS: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
ATT&CK exploitation technique(s): T1078
ATT&CK primary impact: T1005
ATT&CK techniques (all): T1005, T1078
CVE-2012-5054: 
Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments.

CWE: CWE-190 Integer Overflow or Wraparound
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1189
ATT&CK techniques (all): T1189
CVE-2020-5371: 
Dell EMC Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale version 9.0.0 contain a file permissions vulnerability. An attacker, with network or local file access, could take advantage of insufficiently applied file permissions or gain unauthorized access to files.

Affected products: Dell Isilon OneFS
CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
ATT&CK primary impact: T1068
ATT&CK secondary impact: T1005
ATT&CK techniques (all): T1005, T1068
CVE-2018-11776: 
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

Affected products: Apache Software Foundation Apache Struts
CWE: Remote Code Execution, CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1496
ATT&CK techniques (all): T1059, T1068, T1190, T1496
CVE-2019-1132: 
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.

Affected products: Microsoft Windows, Microsoft Windows Server
CWE: Elevation of Privilege, CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1190
CVE-2019-12696: Cisco Firepower System Software Detection Engine RTF and RAR Malware and File Policy Bypass Vulnerabilities
Multiple vulnerabilities in the Cisco Firepower System Software Detection Engine could allow an unauthenticated, remote attacker to bypass configured Malware and File Policies for RTF and RAR file types. For more information about these vulnerabilities, see the Details section of this advisory.

Affected products: Cisco Cisco FireSIGHT System Software
CWE: CWE-693
CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
ATT&CK exploitation technique(s): T1204.002
ATT&CK primary impact: T1190
ATT&CK techniques (all): T1190, T1204.002